This invention is directed generally to three-phase switching power systems that utilize half-bridge inverters and that exhibit very high reliability and redundancy. More particularly, the present invention is directed to a recovery method that facilitates dynamic reconfiguration of the Main Power Processing Unit (MPPU) to maintain it in fully functional condition at a reduced power level in the event of failure of one of the three half-bridge circuits. Failure of half-bridge circuits is typically caused by failure of a switching power device.
Three-phase power switching systems are employed in DC power generators for gridded Ion engines and Hall thrusters installed on satellites. These DC power generators must be light weight and exhibit exceptional redundancy in environments in which silicone power switches may be damaged by radiation, typically by heavy ion bombardment.
A typical satellite electric propulsion system contains at least two gridded Ion engines or Hall thruster units, each having its own DC Power Processing Unit (PPU). Each PPU is paired with an electric thruster with no redundancy other than the other PPU-thruster pair. One of the PPUs is typically operational while another is redundant and used only when the first one is no longer operational due to failure of a component.
The heaviest part of the PPU is usually the discharge power supply in Hall thrusters and the grid power supply in gridded Ion engines. The weight of a three-phase MPPU is primarily defined by the three-phase transformers as they are the heaviest components in the MPPU. These transformers could be implemented as a single three-phase transformer or as three single-phase transformers, each controlled by a half-bridge circuit, using either power MOSFETs or other power switching devices. The MPPU ceases to be operational if one of the half-bridge power switches fails. The failed half-bridge circuit must be disconnected from the satellite power bus in order to permit continued operation of the rest of the system. Typically, the required power disconnect is accomplished by fuses or fast-operating semiconductor switches. Prior art MPPUs are unable to deliver any power if a power transistor fails shorted. The damaged MPPUs may contain some functional power switches, but if any one switch fails, the entire system becomes non-functional.
A number of fault-tolerant power converter circuits are known in the prior art. Among them are U.S. Pat. No. 5,499,186 to Carossa, U.S. Pat. No. 5,708,576 to Jones et al., and U.S. Pat. No. 7,602,623 to Chung et al. This prior art is representative of circuits that employ an additional switch in parallel with each power switch in a half-bridge circuit for use in combination with its own disconnect device in order to isolate a failed power switch and maintain redundancy. These circuits are disadvantageous in that they require additional hardware to drive the redundant switch and additional disconnect and/or current sensing components.
Another prior art approach for maintaining MPPU redundancy is to implement the MPPU using multiple low power modules, connected to the load in parallel, equipped with a circuit that allows automatic disconnect of the failed power supply from the load and input bus. Representative of these circuits are those described in U.S. Pat. No. 4,150,425 to Nagano et al. and U.S. Pat. No. 5,359,180 to Park et al.
Usually, an MPPU configured as described in the preceding paragraph, requires N+1 power modules. N modules are required to meet mission requirements, and one module is redundant. This method requires additional hardware that is not normally in use. In case lower power operations are allowed, this approach implies extra weight, because each power supply requires a complete control circuit. Circuit elements that are located in the high current path decrease the overall efficiency of those power supplies even when operating at lower power levels.
It would therefore be advantageous to provide an MPPU that employs a control circuit implemented in discrete logic, a programmable logic device, or Application Specific Integrated Circuits (ASICs) to permit dynamic reconfiguration of the MPPU control system to maintain the MPPU in fully functional condition at a reduced power level, compared to its nominal power level, in the event of failure of one of the three half-bridge circuits caused by a failure of one of the switching power devices.
In accordance with the illustrated preferred embodiment of the invention, the control circuit generates pulses that are shifted 120 degrees from other 120-degree shifted pulses for the half-bridge circuits in normal operation mode, providing full power delivery. A high current spike event is detected in the half-bridge circuit if one of the power switches is damaged, for example, by heavy ion particle bombardment, and the opposite power switch is turning ON.
The present control circuit disconnects the operational power switch in the failed half-bridge circuit and reconfigures timing for the remaining two half-bridge circuits so they operate in full-bridge mode at a lower power range. The power range of the PPU circuit will be maintained at approximately 66% of nominal power.
The control circuit of the present invention maintains redundancy of the Ion Engine PPU in case of a power switch component failure. This circuit permits elimination of the prior art redundant PPU if the propulsion system permits power reduction, thereby permitting a significant reduction in weight of the propulsion system.